Information Disclosure in Rocket.Chat

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your Rocket.Chat installation to one of the fixed versions: 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, or 7.10.12.

This will ensure that the token is no longer returned in the visitors.info endpoint response, removing the security risk.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the exposure of a token in the response from the visitors.info endpoint in Rocket.Chat versions prior to the fixed releases.

To detect this vulnerability on your system or network, you can attempt to query the visitors.info endpoint and inspect the response for the presence of a token.

A possible command to test this using curl would be:

• curl -k -H "Authorization: Bearer <valid_token>" https://<rocket.chat-server>/api/v1/visitors.info?visitorId=<visitor_id>

If the response contains a token field, the system is vulnerable. If the token is absent, the system is likely patched.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability exposes a Bearer token and sensitive visitor information without proper authorization, which can lead to unauthorized access to confidential data.

Such unauthorized disclosure of sensitive information can negatively impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls over personal and sensitive data to ensure confidentiality and integrity.

The issue is due to improper authorization (CWE-285), indicating a failure to enforce access controls, a key requirement in these standards.

Fixing this vulnerability by removing the token from the response and enforcing proper authorization helps maintain compliance with these regulations.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive tokens through the visitors.info endpoint. Since the token is returned in the response without a valid use case, it could be exploited by attackers to gain unauthorized access or escalate privileges, potentially compromising confidentiality, integrity, and availability of the system.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Rocket.Chat versions prior to 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12. It involves the visitors.info endpoint returning a token in its response, which appears to have no legitimate use case. The presence of this token in the response is considered a security risk, and the vulnerability was fixed by removing the token from the response in the specified versions.

Useful 0 Not Useful 0